CVE-2026-98484

Received Received - Intake

Heap Use-After-Free in Linux Kernel Netfilter nf_tables

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_set_catchall_lookup() and the dump path additionally skip expired elements. Once a catchall element with a timeout expires, this predicate drift makes it invisible to userspace dumps, yet it still blocks re-insertion: with NLM_F_EXCL the request fails with -EEXIST, and without it the request reports success but silently inserts nothing. The stale entry only goes away when the (user-tunable) gc interval elapses, so the catchall rule may silently stop matching for an arbitrarily long time after its first expiration. The delete path shows the same drift: nft_setelem_catchall_deactivate() picks the first active-next entry in the catchall list, so with an expired entry still pending GC it retires the stale entry instead of the fresh one, and it deactivates an element that userspace no longer sees instead of failing with -ENOENT. Align both walks with the lookup and dump predicates: only an element that is active and not expired counts as a duplicate or delete candidate, using the per-netns timestamp taken at transaction start, in line with the set backend .insert/.deactivate and catchall GC sync paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98484

EUVD

EUVD-2026-103724

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	aaa31047a6d25da0fa101da1ed544e1247949b40
Linux	Linux	aaa31047a6d25da0fa101da1ed544e1247949b40
Linux	Linux	aaa31047a6d25da0fa101da1ed544e1247949b40
Linux	Linux	aaa31047a6d25da0fa101da1ed544e1247949b40
Linux	Linux	5.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the netfilter nf_tables component. It involves a mismatch in how expired catchall elements are handled during insert, delete, and lookup operations. The issue causes expired elements to remain visible for deletion or insertion checks but invisible in dumps, leading to inconsistent behavior and potential silent failures in rule matching.

Detection Guidance

This vulnerability affects the Linux kernel's netfilter nf_tables component. Detection requires checking kernel logs for nf_tables-related errors or examining active rules for stale catchall elements. Use commands like 'dmesg | grep nf_tables' or 'nft list ruleset' to inspect rules. If expired catchall elements are present, they may silently fail to match traffic.

Impact Analysis

This vulnerability can cause network rules to stop functioning unexpectedly. After a catchall rule expires, it may silently stop matching traffic until garbage collection runs, which could be delayed. This might lead to unintended network access or blocking, disrupting firewall rules or security policies.

Compliance Impact

This vulnerability in the Linux kernel's netfilter nf_tables could potentially impact compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized network access or data exposure due to incorrect handling of expired catchall elements in firewall rules. Misconfigured or stale firewall rules may fail to enforce intended security policies, creating gaps in network security controls required by these standards.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98484. Monitor for expired catchall elements in nf_tables and ensure garbage collection intervals are set appropriately.

Hi! I’m here to help you understand CVE-2026-98484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70